Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,866
- Published in 7 days
- 987
- Critical in 30 days
- 359
- Actively exploited
- 423
Latest vulnerabilities
39,866 vulnerabilities- High 8.8
CVE-2019-17534 · libvips
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free.
Published 13 Oct 2019 · Fixed in 8.8.2 · NVD - Critical 9.8
CVE-2019-17531 · Oracle WebLogic Server
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a…
Published 12 Oct 2019 · NVD - High 7.5
CVE-2019-17514 · Python
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no…
Published 12 Oct 2019 · NVD - Medium 6.1
CVE-2019-17496 · Craft CMS
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
Published 11 Oct 2019 · Fixed in 3.3.8 · NVD - High 8.8
CVE-2019-5527 · VMware ESXi
ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.5.
Published 10 Oct 2019 · NVD - Medium 6.1
CVE-2019-17427 · Redmine
In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
Published 10 Oct 2019 · Fixed in 3.4.11, 4.0.4 · NVD - High 7.8
CVE-2019-16905 · OpenSSH
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions,…
Published 9 Oct 2019 · Fixed in 8.1 · NVD - Medium 6.1
CVE-2019-17092 · OpenProject
An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.
Published 9 Oct 2019 · Fixed in 9.0.4, 10.0.2 · NVD - Medium 5.9
CVE-2019-6471 · F5 BIG-IP, BIND 9
A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 ->…
Published 9 Oct 2019 · NVD - High 7.5
CVE-2019-6469 · BIND 9
An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has malformed RRSIGs. Versions affected: BIND 9.10.5-S1 -> 9.11.6-S1 of BIND 9 Supported Preview Edition.
Published 9 Oct 2019 · NVD - High 7.5
CVE-2019-6468 · BIND 9
In BIND Supported Preview Edition, an error in the nxdomain-redirect feature can occur in versions which support EDNS Client Subnet (ECS) features. In those versions which have ECS support, enabling nxdomain-redirect is likely to lead to BIND exiting due to assertion failure. Versions affected: BIND Supported Preview Edition version 9.10.5-S1 -> 9.11.5-S5. ONLY BIND Supported Preview Edition…
Published 9 Oct 2019 · NVD - High 7.5
CVE-2019-6467 · BIND 9
A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring…
Published 9 Oct 2019 · NVD - Medium 5.3
CVE-2019-6465 · BIND 9
Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been…
Published 9 Oct 2019 · NVD - Medium 6.1
CVE-2019-17380 · cPanel & WHM
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
Published 9 Oct 2019 · Fixed in 82.0.15 · NVD - Medium 6.1
CVE-2019-17379 · cPanel & WHM
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).
Published 9 Oct 2019 · Fixed in 78.0.39, 82.0.15 · NVD - Medium 6.1
CVE-2019-17378 · cPanel & WHM
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).
Published 9 Oct 2019 · Fixed in 78.0.39, 82.0.15 · NVD - Medium 6.1
CVE-2019-17377 · cPanel & WHM
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
Published 9 Oct 2019 · Fixed in 78.0.39, 82.0.15 · NVD - Medium 6.1
CVE-2019-17376 · cPanel & WHM
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
Published 9 Oct 2019 · Fixed in 78.0.39, 82.0.15 · NVD - High 8.8
CVE-2019-17375 · cPanel & WHM
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
Published 9 Oct 2019 · Fixed in 82.0.15 · NVD - High 7.5
CVE-2019-15226 · Envoy
Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum…
Published 9 Oct 2019 · NVD - Medium 4.9
CVE-2018-5745 · BIND 9
"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an…
Published 9 Oct 2019 · NVD - High 7.5
CVE-2018-5744 · BIND 9
A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.
Published 9 Oct 2019 · Fixed in 9.11.5, 9.12.3, 9.13.6 · NVD - High 7.5
CVE-2018-5743 · F5 BIG-IP, BIND 9
By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous…
Published 9 Oct 2019 · NVD - Critical 9.1
CVE-2019-17382 · Zabbix
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin.
Published 9 Oct 2019 · NVD - High 7.5
CVE-2019-17359 · Oracle WebLogic Server
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Published 8 Oct 2019 · NVD - Medium 4.9
CVE-2019-17271 · vBulletin
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
Published 8 Oct 2019 · NVD - Medium 5.5
CVE-2019-17349 · Xen
An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.
Published 8 Oct 2019 · NVD - Medium 6.5
CVE-2019-17348 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
Published 8 Oct 2019 · NVD - High 7.8
CVE-2019-17347 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels).
Published 8 Oct 2019 · NVD - High 8.8
CVE-2019-17346 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.
Published 8 Oct 2019 · NVD - Medium 6.5
CVE-2019-17345 · Xen
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
Published 8 Oct 2019 · NVD - Medium 6.5
CVE-2019-17344 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates.
Published 8 Oct 2019 · NVD - Medium 6.8
CVE-2019-17343 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains.
Published 8 Oct 2019 · NVD - High 7.0
CVE-2019-17342 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.
Published 8 Oct 2019 · NVD - High 7.8
CVE-2019-17341 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.
Published 8 Oct 2019 · NVD - High 8.8
CVE-2019-17340 · Xen
An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled.
Published 8 Oct 2019 · NVD - Medium 6.5
CVE-2019-17351 · Xen
An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.
Published 8 Oct 2019 · NVD - Medium 5.5
CVE-2019-17350 · Xen
An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation.
Published 8 Oct 2019 · NVD - Critical 9.8
CVE-2019-17267 · Oracle WebLogic Server
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Published 7 Oct 2019 · NVD - Critical 9.8
CVE-2019-16891 · Liferay Portal / DXP
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
Published 4 Oct 2019 · NVD - Critical 9.8
CVE-2019-17132 · vBulletin
vBulletin through 5.5.4 mishandles custom avatars.
Published 4 Oct 2019 · NVD - Medium 4.3
CVE-2019-17131 · vBulletin
vBulletin before 5.5.4 allows clickjacking.
Published 4 Oct 2019 · Fixed in 5.5.4 · NVD - Medium 6.5
CVE-2019-17130 · vBulletin
vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
Published 4 Oct 2019 · NVD - High 7.5
CVE-2019-16866 · Unbound
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
Published 3 Oct 2019 · Fixed in 1.9.4 · NVD - High 7.5
CVE-2018-14880 · F5 BIG-IP
The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().
Published 3 Oct 2019 · NVD - High 7.5
CVE-2018-14468 · F5 BIG-IP
The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().
Published 3 Oct 2019 · NVD - Medium 5.3
CVE-2019-4441 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.
Published 3 Oct 2019 · Fixed in 19.0.0.11 · NVD - High 8.6
CVE-2019-15256 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper management of system memory. An attacker could…
Published 2 Oct 2019 · Fixed in 9.9.2.47, 9.10.1.30, 9.12.2.5 · NVD - Medium 6.1
CVE-2019-15037 · TeamCity
An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.
Published 2 Oct 2019 · NVD - High 7.2
CVE-2019-15036 · TeamCity
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed in TeamCity 2018.2.5 and 2019.1.
Published 2 Oct 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.